PROBE::NETFILTER.B(3stap)

💖 PROBE::NETFILTER.B(3stap) — Networking Tapset 💖

okay bestie, gather round, because this is the probe::netfilter.bridge.local_out page from the SystemTap Tapset Reference, and it's honestly giving networking main character energy 🌉✨ (that's a bridge pun, you're welcome)

---

✨ NAME ✨

probe::netfilter.bridge.local_out — it gets called on a bridging packet that's coming from a local process 🦋

like, the packet is leaving your machine and it's crossing a bridge, and this probe is like "not me catching you on the way out 👀"

---

🌸 SYNOPSIS 🌸

probe netfilter.bridge.local_out {}

that's it. that's the whole synopsis. no args, no nothing. she's low maintenance, she's iconic, she just is 💅

---

🎀 VALUES 🎀

bestie this is the big one, this is the whole buffet, we are NOT skipping a single one because every single value here is part of the lore:

• llcpdu — the address of the LLC Protocol Data Unit
• indev_name — the name of the network device the packet was received on (if it's known, i.e. sometimes she's mysterious)
• br_poid — the port identifier
• protocol — the packet protocol
• nf_stop — a constant that means a 'stop' verdict 🛑
• length — how long the packet buffer contents are, in bytes
• br_rid — the identity of the root bridge
• br_cost — the total cost from the transmitting bridge all the way to the root, no cap
• outdev_name — the name of the network device the packet will be routed to (if it's known)
• brhdr — the address of the bridge header
• data_hex — a hexadecimal string that represents the packet buffer contents
• br_msg — the message age, in 1/256 secs
• data_str — a string that represents the packet buffer contents
• llcproto_stp — a constant that means Bridge Spanning Tree Protocol packet 🌳
• nf_stolen — a constant that means a 'stolen' verdict 😈
• br_vid — the protocol version identifier
• nf_queue — a constant that means a 'queue' verdict
• br_bid — the identity of the bridge
• br_flags — the BPDU flags 🚩
• br_htime — the hello time, in 1/256 secs (hi bridge 👋)
• nf_drop — a constant that means a 'drop' verdict 💀
• br_fd — the forward delay, in 1/256 secs
• br_type — the BPDU type
• indev — the address of the net_device representing the input device, or 0 if it's unknown
• pf — the protocol family, and it's always “bridge” — periodt, no debate
• br_mac — the bridge MAC address
• outdev — the address of the net_device representing the output device, or 0 if it's unknown
• br_rmac — the root bridge MAC address
• br_prid — the protocol identifier
• br_max — the max age, in 1/256 secs
• nf_accept — a constant that means an 'accept' verdict ✅
• nf_repeat — a constant that means a 'repeat' verdict 🔁

ngl bestie, the way there are literally five separate nf_* verdict constants (nf_stop, nf_stolen, nf_queue, nf_drop, nf_accept, and nf_repeat) plus llcproto_stp is so real of this page. verdicts for DAYS. 🧚

also a lil heads up for the vibe check: indev_name and outdev_name are only there if known, and indev and outdev fall back to 0 when they're unknown. pf is the exception — she's “bridge” always and forever 💜

---

👑 SEE ALSO 👑

• tapset::netfilter(3stap) — go read the whole tapset bestie, it's the mothership 🛸

---

SystemTap Tapset Reference, Version (Ver), September 2026 — that's the source and the date of this lil masterpiece, and honestly? she ate. 💖✨🎀🦋🌸💅🫶

k bye, go trace some bridges, ily 🥰🌈⭐